Add another router before the localuser router that only exists to reject the lp/suffix combos you want rejected. Here's an example with the suffixes hard coded:
reject_suffixes:
driver = redirect
local_parts = joe-badsuff1 : joe-badsuff2
allow_fail
fail_verify = true
data = :fail: invalid email <$local_part@$domain>
The other way to go would be to look it up from a file. Same basic concept, just with a file lookup:
reject_suffixes:
driver = redirect
local_parts = /path/to/file
allow_fail
fail_verify = true
data = :fail: invalid email <$local_part@$domain>
The file pointed to by local_parts is just a list of local_parts to reject:
joe-badsuff1
jane-badsuff2
jack-badsuff1
# etc...
I prefer using routers to do this instead of ACLs because it catches all the edge cases like messages submitted locally (and so which don't trip the rcpt acl), etc.